docs(skills): enforce JD integrity — real posting verbatim + Playwright recipe

Add the JD Integrity section to shared_ops (no reconstructed/inferred JDs;
WebFetch is JS-blind on careers boards; scrape JS-gated postings via the
job_scout Playwright venv; STOP and ask if the real text is unobtainable).
Wire the rule into /make-resume and /critique. Allow cisco/bkw WebFetch.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.claude/settings.local.json

@@ -114,7 +114,9 @@
       "Bash(.venv/Scripts/python.exe -c \"import scout; print\\('automated:', len\\(scout.COMPANIES\\), '| manual:', len\\(scout.MANUAL_CHECK\\)\\)\")",
       "Bash(.venv/Scripts/python.exe scout.py)",
       "Bash(.venv/Scripts/python.exe scout.py --only=swissgrid)",
-      "Bash(git push *)"
+      "Bash(git push *)",
+      "WebFetch(domain:careers.cisco.com)",
+      "WebFetch(domain:job.bkw.com)"
     ]
   }
 }

.claude/skills/critique/SKILL.md

@@ -21,6 +21,7 @@ If no CL .tex provided or found in session file, critique resume/CV alone (Part
 **Accuracy > Relevance > Impact > ATS > Brevity**
 
 Read `config.md` Provenance Flags. Verify every claim against that table.
+**JD integrity:** the critique is only as valid as the JD. If the JD source is a reconstruction/inference/template rather than the real posting (see `shared_ops.md` → JD Integrity), STOP — flag it to the user and offer to scrape the live posting (Playwright recipe) before critiquing. Never score against a fabricated JD.
 Check `config.md` KB Corrections Log — do not flag corrected items as errors.
 Use the email from `config.md` Personal Info — flag if a different email appears in output.
 FIXED sections (from `config.md` FIXED Sections) are template-locked — do not flag for editing. Flag only VARIABLE sections.

.claude/skills/make-resume/SKILL.md

@@ -9,11 +9,14 @@ user-invocable: true
 
 Parse `$ARGUMENTS`:
 - File path (e.g., `JDs/*.txt`) → read that file for the JD
+- A URL → this is NOT a JD, it's a pointer. Fetch the real posting text first (see JD Integrity below), save it verbatim to `JDs/<company>_<role>.txt`, then proceed.
 - Text after the path starting with "Focus:"/"Emphasize:"/"Downplay:" → focus directive
 - "Quick:" prefix → Quick Mode (see below)
 - Empty → ask the user for the JD
 - Inline JD text (no file path) → save to `JDs/temp_<company>.txt`, proceed normally
 
+**JD Integrity (read `shared_ops.md` → "JD Integrity"):** The JD must be the real posting, verbatim. NEVER invent, reconstruct, paraphrase, or infer JD content. `WebFetch` is JS-blind on careers boards — use the job_scout Playwright recipe in `shared_ops.md` to scrape JS-gated postings. If you cannot get the real text, STOP and ask the user to paste it. Do not proceed on a guessed JD.
+
 ---
 
 ## Safety Rules (ALWAYS ENFORCED)
@@ -22,6 +25,7 @@ Parse `$ARGUMENTS`:
 
 Read `config.md` Provenance Flags before generating any content. Verify every claim against that table.
 
+- **JD is ground truth — use the real posting verbatim. NEVER reconstruct, invent, or infer a JD** (see `shared_ops.md` → JD Integrity). If you can't get the real text, STOP and ask the user to paste it.
 - Use the email from `config.md` Personal Info in all outputs
 - Resume bullets: ALL variable bullets are 2L (CV: 2L/3L mix OK, check `config.md` Document Preferences)
 - Source ALL bullet content from `resume_builder/experience/` files. Never fabricate.
@@ -74,7 +78,7 @@ Defaults:
 ## Phase 0: Research & Session Setup
 
 **Read these files:**
-1. The JD (from `$ARGUMENTS`)
+1. The JD — the **real posting text**, verbatim. If `$ARGUMENTS` was a URL or the posting is on a JS-gated board, scrape it with the Playwright recipe in `shared_ops.md` (JD Integrity) BEFORE this step and save to `JDs/`/`output/<FolderName>/JD_<name>.txt`. If you cannot obtain the real text, STOP and ask the user to paste it — do NOT reconstruct or infer it.
 2. `resume_builder/reference/resume_reference.md` — Budget Card, Section Specs, Char Limits, Page Budgets
 3. `config.md` — Role-Type Decision Tree to identify the matching bundle